how to manage each firewall in HA from a user vlan

[dsi_b]

hello, here is my problem.

i have a vm that can switch off servers when there is a power outage, managing a ups. that vm can send ssh commands. it's easier to send exec shutdown instead scripting. if the firewall is master, no need to worry, failover will do its job. if the firewall is slave, no failover.

so in order to easily switch off a firewall from a specif location, i need to need to connect to by its own IP address and not from the HA mgmt IP address.

if i configure in band management ip address, the vm needs to be in the same vlan, and that is not possible. i can't add another network card.

is there a solution for the vm to get a ssh connection to a specific firewall, i guess the solution can route the network flow.

maybe out band management? i don't know.

thank you

 

[funkylicious · Accepted solution]

you can use the ip of any interface, if you have enabled the administrative access for it ( http,https,ssh ) , if you are using trusted-hosts then make sure the source of the vm is part of them and that you have a correct route back to the vm from the firewall / any firewall rules that might be required along the path between those 2.

if you want to manage them individually in the HA, just use the - https://docs.fortinet.com/document/fortigate/7.0.0/cli-reference/10620/config-system-interface#:~:te... under the interface in question

[dsi_b]

hello, as i said i already tried to set an ip management on a physical interface on both firewalls(in band management https://community.fortinet.com/t5/FortiGate/Technical-Tip-Implement-In-Band-Management-IP-for-HA-Clu...)

you need to be on the same vlan to access to the firewall gui or ssh on both firewalls in this way.

if you are on a seperate vlan, only the master responds (ping, gui or ssh)  from a seperate vlan, not the slave. you only can ping the slave from the master. that doesn't answer to my need.

[funkylicious]

i've done plenty of deployments this way and worked everytime from a separate network, maybe because I had a route back to the source via router/L3 device in the same subnet where I assigned the management-ip on the interface.

[dsi_b]

hello, i tried several scenarios using only the firewall cluster as router (no other L3) from the vm which gateway is the cluster.

- in band management : you can only join the active firewall on it's own mgmt ip adresse because the network is listed in the router table and linked to the active firewall. you can't join the second firewall because there is no gateway for this network even if the rule to access to the second firewall is ok.

-out band management : you can't join both firewall. the network is not listed in the firewall router table. 

my solution tested : out band management and added a L3 clustered IP to both switch where firewalls are connected to. the automatic routing protocol do its job. firewalls have the gateway to the individual management network in the HA configuration. i will need to add ACLs to L3 swiches and maybe trusted hosts on firewalls.

at the begining i did not wanted to add other L3 to get a simple network to manage.

thank you for your help.

[kmohan]

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Implement-In-Band-Management-IP-for-HA-Clu...)